@lotics/app-sdk 0.55.0 → 0.55.1

package/dist/src/rpc.d.ts

@@ -159,6 +159,16 @@ export interface AgentRunContinuePayload {
  * `rpcAgentRun` streams the first.
  */
 export declare function rpcAgentRunContinue(payload: AgentRunContinuePayload, onText: (chunk: string) => void): AgentRunHandle;
+/**
+ * The password-session header. It is deliberately NOT `Authorization`: this
+ * token authenticates nobody — it proves the visitor knows the app's shared
+ * link password — and the credential header already carries API keys and OAuth
+ * bearers. Sharing it meant the server's auth middleware rejected the request
+ * as an unknown bearer before the password gate ever ran, which took every
+ * password-gated public app offline. Wire constant, mirrored server-side by
+ * `APP_PUBLIC_SESSION_HEADER`; both sides are pinned by tests.
+ */
+export declare const APP_PUBLIC_SESSION_HEADER = "x-lotics-app-session";
 /**
  * The error message for a non-ok response. A genuine JSON error (a 4xx carrying
  * a `message`) surfaces verbatim; a non-JSON body (a gateway HTML page), any

package/dist/src/rpc.js

@@ -250,7 +250,7 @@ export function rpcAgentRunContinue(payload, onText) {
         const { app_id } = await boot();
         const headers = { "content-type": "application/json" };
         if (sessionToken)
-            headers["authorization"] = `Bearer ${sessionToken}`;
+            headers[APP_PUBLIC_SESSION_HEADER] = sessionToken;
         const res = await fetch(`${API_BASE}/v1/apps/${app_id}/agent-runs/${encodeURIComponent(payload.run_id)}/continue`, {
             method: "POST",
             headers,
@@ -288,7 +288,7 @@ function agentRunStandalone(payload, onText, onRunId) {
         const { app_id } = await boot();
         const headers = { "content-type": "application/json" };
         if (sessionToken)
-            headers["authorization"] = `Bearer ${sessionToken}`;
+            headers[APP_PUBLIC_SESSION_HEADER] = sessionToken;
         const res = await fetch(`${API_BASE}/v1/apps/${app_id}/agents/${encodeURIComponent(payload.alias)}/runs`, {
             method: "POST",
             headers,
@@ -336,6 +336,16 @@ const PASSWORD_REQUIRED_CODE = "PASSWORD_REQUIRED";
 let bootPromise = null;
 let appInfoPromise = null;
 let sessionToken = null;
+/**
+ * The password-session header. It is deliberately NOT `Authorization`: this
+ * token authenticates nobody — it proves the visitor knows the app's shared
+ * link password — and the credential header already carries API keys and OAuth
+ * bearers. Sharing it meant the server's auth middleware rejected the request
+ * as an unknown bearer before the password gate ever ran, which took every
+ * password-gated public app offline. Wire constant, mirrored server-side by
+ * `APP_PUBLIC_SESSION_HEADER`; both sides are pinned by tests.
+ */
+export const APP_PUBLIC_SESSION_HEADER = "x-lotics-app-session";
 function sessionStorageKey(appId) {
     return `lotics_app_session:${appId}`;
 }
@@ -478,7 +488,7 @@ async function apiCall(method, path, body, opts) {
     if (body)
         headers["content-type"] = "application/json";
     if (sessionToken && !opts?.skipAuth) {
-        headers["authorization"] = `Bearer ${sessionToken}`;
+        headers[APP_PUBLIC_SESSION_HEADER] = sessionToken;
     }
     const controller = new AbortController();
     let didTimeout = false;

package/docs/runtime.md

@@ -132,8 +132,12 @@ coalesce; a transient failure isn't cached, the next call retries). If the app
 is password-protected, the SDK renders its own full-screen password overlay
 (plain DOM, so it works before React data arrives), exchanges the password for a
 session token, and stores it in `localStorage` under
-`lotics_app_session:<app_id>` with its expiry. The token rides as a `Bearer`
-header on subsequent calls; a `401` with error code `PASSWORD_REQUIRED` (the
+`lotics_app_session:<app_id>` with its expiry. The token rides on subsequent
+calls in its own `X-Lotics-App-Session` header — deliberately not
+`Authorization`, which carries API keys and OAuth bearers: this token
+authenticates nobody, it proves the visitor knows the shared password, and
+sharing the credential header made the auth layer reject it before the password
+gate could read it. A `401` with error code `PASSWORD_REQUIRED` (the
 owner rotated or cleared the password) drops the stored token, re-prompts, and
 retries the original call once. There is no cancel button — the visitor enters
 the password or leaves. When `localStorage` is unavailable (private browsing,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lotics/app-sdk",
-  "version": "0.55.0",
+  "version": "0.55.1",
   "description": "Runtime SDK for Lotics custom-code apps — typed hooks, postMessage bridge, mount entry point",
   "type": "module",
   "exports": {